Inside the $1.3B North Korean Cyber Heist

November 12, 2026 · 5 min read

In February 2021, the U.S. Department of Justice unsealed an indictment in Los Angeles, revealing that three North Korean officers had engineered some of the world’s deadliest ransomware. The charges identified Jon Chang Hyok, Park Jin Hyok, and Kim Il as the architects behind a campaign that siphoned over $1.3 billion in cash and cryptocurrency from victims worldwide. This legal action marked a significant chapter in the evolving landscape of cyberwar, linking these individuals to the 2017 WannaCry attack and other massive financial heists.

At the heart of this operation lies the Lazarus Group, a cybercrime unit attributed to North Korea’s Reconnaissance General Bureau. This secretive intelligence arm has turned code into currency, building a modern empire on silence and digital stealth. By tracing the roots of this state-sponsored network, we uncover how a series of attacks, from Hollywood to global banking, evolved into a sophisticated machine for theft and geopolitical power.

The Hollywood Retaliation: Sony Pictures 2014

In November 2014, a storm brewed from the East that changed the face of Hollywood. Hackers infiltrated Sony Pictures Entertainment’s servers in Los Angeles, siphoning confidential data, unreleased films, and internal emails. The motive was chillingly clear: retaliation for a comedy that dared to imagine the assassination of Kim Jong Un. The breach stalled releases and drained revenue, delivering an unprecedented blow to the entertainment industry and signaling a new era of state-sponsored cyber warfare.

The mastermind behind this assault was Park Jin Hyok, a name that would later surface in 2018 and 2021 indictments. This attack marked a turning point where espionage gave way to active sabotage. Governments worldwide reexamined their cyber defenses, while the private sector realized that a joke could be a weapon. The ripple effect was global, prompting massive budget hikes and new international cooperation to address the growing threat of digital attacks.

WannaCry: A Global Digital Storm

Fast forward to May 2017, when the WannaCry 2.0 ransomware swept across the globe, infecting computers in more than 150 countries. The malware encrypted data and demanded Bitcoin for decryption, causing tremors in every sector, but none more starkly than the United Kingdom’s National Health Service. Around forty NHS trusts saw their systems grind to a halt, forcing surgeons to postpone operations and leaving patients in uncertainty. The attack proved the destructive potential of tools forged by the Lazarus Group.

Investigators traced the fingerprints of this chaos to three North Korean operatives: Jon Chang Hyok, Park Jin Hyok, and Kim Il. The 2021 U.S. indictment officially linked these names to the deployment of the ransomware. The operation highlighted why a nation might invest in cyber weapons that demand anonymous cryptocurrency: the payoff provides unrestricted access to global data and a revenue stream that bypasses sanctions, feeding a regime desperate for hard cash.

Cracking the Banking System

In 2016, the North Korean cyber unit executed a massive heist against the global banking system. They cracked the defenses of Bangladesh Bank, slipping $81 million through a series of wire transfers via the SWIFT network. The money vanished into a labyrinth of accounts, surfacing in the hands of a Canadian-American citizen named Ghaleb Alaumary. Using a dual-national helped confuse the trail, making it harder for investigators to pin down the true owners of the stolen funds.

The 2021 indictment painted this scheme as a coordinated wire fraud conspiracy, linking hackers, money mules, and state sponsors. The $81 million was split, with some funneled into cryptocurrency and others into shell companies in offshore havens. Each step added a layer of opacity, a deliberate fog that the North Korean unit knew how to navigate. The fallout was global, leading banks to tighten SWIFT protocols and regulators to issue new guidelines for transaction oversight.

The Crypto Gold Rush

By 2019, the digital gold rush had begun to crack the vaults of the world's most trusted exchanges. A trio of North Korean operatives plotted to siphon billions from crypto giants and banks alike. Their first major strike hit a cryptocurrency exchange, draining $112 million in a single silent operation. Over the next two years, the thefts spiraled, targeting banks, payment processors, and decentralized finance platforms. By 2020, the cumulative damage exceeded $1.3 billion, a figure that dwarfs the profits of many Fortune 500 companies.

The U.S. Department of Justice dubbed them 'the world's leading bank robbers.' Their method was simple yet chilling: infiltrate a system, plant malware, and watch digital currency vanish. They leveraged the anonymity of the blockchain, using covert servers in Russia and masquerading as legitimate tech consultants in China. The stolen funds were funneled back to state-controlled entities in North Korea, bolstering the regime and turning the case into a geopolitical chess game watched closely by global powers.

Espionage and Extortion

In the early 2010s, a hidden campaign targeted U.S. defense and energy infrastructure. State Department officials and senior Pentagon staff were duped into handing over their credentials, opening a backdoor into classified networks. With those passwords, hackers slipped past firewalls to steal blueprints, project timelines, and personal IDs. Acting Attorney Wilkison described the conduct as 'extensive and long-running,' hinting at years of silent data theft that blurred the line between espionage and robbery.

The strategy had two engines: one stole secrets, and the other stole money. Spying and extortion ran parallel, feeding off each other. Behind it all stood the Reconnaissance General Bureau, North Korea’s premier intelligence agency. While the U.S. scrambled to contain the breach, the illicit proceeds were moved into shadow accounts. This dual-track strategy showed a chilling evolution where cyber tools were used not just to watch, but to fund the very regimes that wielded them, reshaping the balance of power on the global stage.

Fugitives in the Shadows

As of 2025, the shadows grow longer. Jon Chang Hyok, whose name haunts the FBI’s Cyber Most Wanted list, remains free. The trio—Jon Chang Hyok, Park Jin Hyok, and Kim Il—are believed to be safe in a country that refuses extradition. Their indictment, sealed in Los Angeles in February 2021, charged them with wire fraud and bank fraud conspiracies. The choice of Los Angeles for the courtroom was strategic, leveraging the city’s tech hubs to make the case global.

The U.S. Department of Justice keeps them as fugitives, a status that feeds the mystery. The river of stolen money remains hidden, flowing through a North Korean safe haven. The indictment revealed the scale of their operation, but the final destination of the funds and the specific mechanisms of their evasion remain partially obscured. The case stands as a testament to the resilience of state-sponsored cybercrime, where silence and code continue to build an empire of shadows.

Frequently asked questions

Who are the three North Korean officers indicted in 2021?

The three officers named in the February 2021 indictment are Jon Chang Hyok, Park Jin Hyok, and Kim Il. They were identified as the architects of a campaign that stole over $1.3 billion and linked to the 2017 WannaCry ransomware.

What was the motive behind the 2014 Sony Pictures hack?

The motive was retaliation for a comedy film that dared to imagine the assassination of Kim Jong Un. The hackers infiltrated Sony’s servers to steal confidential data and unreleased films, causing significant operational damage.

How did the North Korean unit launder the $81 million from Bangladesh Bank?

The money was split and funneled into cryptocurrency and shell companies in offshore havens. A portion was transferred to a Canadian-American citizen named Ghaleb Alaumary, while other slices moved through European correspondent banks to obscure the trail.

The bottom line

The 2021 indictment exposed a sophisticated, state-sponsored cybercrime operation that stole over $1.3 billion through ransomware and banking heists. By linking the Lazarus Group to attacks like WannaCry and the Bangladesh Bank breach, the U.S. highlighted the geopolitical stakes of digital theft. The fugitive status of the accused officers underscores the challenges of enforcing cyber laws across borders. This case marks a pivotal shift in how nations view code as a weapon of economic and political power.

Prefer to watch?The full story is on YouTube.